@webda/core 4.0.0-beta.2 → 4.0.0-beta.3

package/lib/services/oauth.js

@@ -1,168 +1,233 @@
-import { Counter } from "../core.js";
-import { WebdaError } from "../index.js";
-import { RegExpStringValidator, Service, ServiceParameters } from "./service.js";
-export class OAuthServiceParameters extends ServiceParameters {
-    constructor(params) {
-        super(params);
-        this.scope ?? (this.scope = ["email"]);
-        this.exposeScope ?? (this.exposeScope = false);
-        this.authenticationService ?? (this.authenticationService = "Authentication");
-        this.authorized_uris ?? (this.authorized_uris = []);
-        this.no_referer ?? (this.no_referer = false);
+var __runInitializers = (this && this.__runInitializers) || function (thisArg, initializers, value) {
+    var useValue = arguments.length > 2;
+    for (var i = 0; i < initializers.length; i++) {
+        value = useValue ? initializers[i].call(thisArg, value) : initializers[i].call(thisArg);
     }
-}
-/**
- * OAuth service implementing the default OAuth workflow
- * It is abstract as it does not manage any provider as is
- */
-export class OAuthService extends Service {
+    return useValue ? value : void 0;
+};
+var __esDecorate = (this && this.__esDecorate) || function (ctor, descriptorIn, decorators, contextIn, initializers, extraInitializers) {
+    function accept(f) { if (f !== void 0 && typeof f !== "function") throw new TypeError("Function expected"); return f; }
+    var kind = contextIn.kind, key = kind === "getter" ? "get" : kind === "setter" ? "set" : "value";
+    var target = !descriptorIn && ctor ? contextIn["static"] ? ctor : ctor.prototype : null;
+    var descriptor = descriptorIn || (target ? Object.getOwnPropertyDescriptor(target, contextIn.name) : {});
+    var _, done = false;
+    for (var i = decorators.length - 1; i >= 0; i--) {
+        var context = {};
+        for (var p in contextIn) context[p] = p === "access" ? {} : contextIn[p];
+        for (var p in contextIn.access) context.access[p] = contextIn.access[p];
+        context.addInitializer = function (f) { if (done) throw new TypeError("Cannot add initializers after decoration has completed"); extraInitializers.push(accept(f || null)); };
+        var result = (0, decorators[i])(kind === "accessor" ? { get: descriptor.get, set: descriptor.set } : descriptor[key], context);
+        if (kind === "accessor") {
+            if (result === void 0) continue;
+            if (result === null || typeof result !== "object") throw new TypeError("Object expected");
+            if (_ = accept(result.get)) descriptor.get = _;
+            if (_ = accept(result.set)) descriptor.set = _;
+            if (_ = accept(result.init)) initializers.unshift(_);
+        }
+        else if (_ = accept(result)) {
+            if (kind === "field") initializers.unshift(_);
+            else descriptor[key] = _;
+        }
+    }
+    if (target) Object.defineProperty(target, contextIn.name, descriptor);
+    done = true;
+};
+import * as WebdaError from "../errors/errors.js";
+import { Service } from "./service.js";
+import { getUuid } from "@webda/utils";
+import { Route } from "../rest/irest.js";
+import { Counter } from "../metrics/metrics.js";
+import { RegExpStringValidator } from "@webda/utils";
+import { ServiceParameters } from "../services/serviceparameters.js";
+import { useService } from "../core/hooks.js";
+/** Parameters for OAuth services including client credentials, scopes, and redirect URIs */
+export class OAuthServiceParameters extends ServiceParameters {
     /**
-     * Ensure default parameter url
+     * Scope to request on OAuth flow
+     *
+     * @defaut ["email"]
      */
-    constructor(webda, name, params) {
-        var _a;
-        super(webda, name, params);
-        (_a = this.parameters).url ?? (_a.url = this.getDefaultUrl());
-    }
-    initMetrics() {
-        super.initMetrics();
-        this.metrics.login = this.getMetric(Counter, {
-            name: "oauth_login",
-            help: "count the number of login",
-            labelNames: ["method"]
-        });
-    }
+    scope;
     /**
-     * Load parameters
+     * If set to true it will add a ${url}/scope
+     * So client can anticipate the requested scope
+     *
+     * This is useful when using the client api to generate
+     * token. This way the service can request the wanted scope
      *
-     * @param params
+     * @default false
      */
-    loadParameters(params) {
-        const result = new OAuthServiceParameters(params);
-        if (result.authorized_uris === undefined) {
-            this.log("WARN", "Not defining authorized_uris is a security risk");
-        }
-        else {
-            this.authorized_uris = new RegExpStringValidator(result.authorized_uris);
-        }
-        return result;
-    }
+    exposeScope;
     /**
-     * Allow callback referer to access this url no matter what
-     * @param context
-     * @returns
+     * List of URIs authorized for redirect post authorization
+     *
+     * @default []
      */
-    async checkRequest(context) {
-        // Only authorize url from this service
-        if (!context.getHttpContext().getRelativeUri().startsWith(this.parameters.url)) {
-            return false;
-        }
-        const regexps = this.getCallbackReferer();
-        let valid = false;
-        const referer = context.getHttpContext().getUniqueHeader("referer", "");
-        if (this.parameters.no_referer && referer === "") {
-            return true;
-        }
-        for (const i in regexps) {
-            valid = referer.match(regexps[i]) !== null;
-            if (valid) {
-                break;
-            }
-        }
-        return valid;
-    }
+    authorized_uris;
     /**
-     * Resolve dynamic dependancy
+     * Default redirect_uri
+     *
+     * @default ${url}/callback
      */
-    resolve() {
-        super.resolve();
-        this._authenticationService = this.getService(this.parameters.authenticationService);
-        return this;
-    }
+    redirect_uri;
     /**
-     * Get OAuth callback query parameters
-     * @returns
+     * Allow direct connection without a referer
+     *
+     * @default false
      */
-    getCallbackQueryParams() {
-        return [
-            {
-                name: "code",
-                required: true
-            },
-            {
-                name: "scope",
-                required: true
-            },
-            {
-                name: "state",
-                required: true
-            }
-        ];
-    }
+    no_referer;
     /**
-     * Add routes for the authentication
+     * Name of the authentication service to use if exist
+     * @default Authentication
      */
-    initRoutes() {
-        super.initRoutes();
-        const name = this.getName();
-        this.addRoute(`${this.parameters.url}{?redirect?}`, ["GET"], this._redirect, {
-            get: {
-                description: `Log with a ${name} account`,
-                summary: `Redirect to ${name}`,
-                operationId: `logInWith${name}`,
-                responses: {
-                    "302": {
-                        description: ""
-                    },
-                    "400": {
-                        description: "Missing token"
+    authenticationService;
+    /**
+     * Load parameters with defaults for scopes, auth service, and URI settings
+     * @param params - the service parameters
+     * @returns the result
+     */
+    load(params) {
+        super.load(params);
+        this.scope ??= ["email"];
+        this.exposeScope ??= false;
+        this.authenticationService ??= "Authentication";
+        this.authorized_uris ??= [];
+        this.no_referer ??= false;
+        return this;
+    }
+}
+/**
+ * OAuth service implementing the default OAuth workflow
+ * It is abstract as it does not manage any provider as is
+ */
+let OAuthService = (() => {
+    let _classSuper = Service;
+    let _instanceExtraInitializers = [];
+    let __redirect_decorators;
+    return class OAuthService extends _classSuper {
+        static {
+            const _metadata = typeof Symbol === "function" && Symbol.metadata ? Object.create(_classSuper[Symbol.metadata] ?? null) : void 0;
+            __redirect_decorators = [Route(".{?redirect?}", ["GET"], {
+                    get: {
+                        description: "Log with a ${name} account",
+                        summary: "Redirect to ${name}",
+                        operationId: "logInWith${name}",
+                        responses: {
+                            "302": { description: "" },
+                            "400": { description: "Missing token" }
+                        }
                     }
-                }
+                })];
+            __esDecorate(this, null, __redirect_decorators, { kind: "method", name: "_redirect", static: false, private: false, access: { has: obj => "_redirect" in obj, get: obj => obj._redirect }, metadata: _metadata }, null, _instanceExtraInitializers);
+            if (_metadata) Object.defineProperty(this, Symbol.metadata, { enumerable: true, configurable: true, writable: true, value: _metadata });
+        }
+        _authenticationService = __runInitializers(this, _instanceExtraInitializers);
+        authorized_uris;
+        /**
+         * Ensure default parameter url
+         * @param name - the service name
+         * @param params - the service parameters
+         */
+        constructor(name, params) {
+            super(name, params);
+            this.parameters.url ??= this.getDefaultUrl();
+        }
+        /** Initialize OAuth-specific metrics for tracking logins */
+        initMetrics() {
+            super.initMetrics();
+            this.metrics.login = this.getMetric(Counter, {
+                name: "oauth_login",
+                help: "count the number of login",
+                labelNames: ["method"]
+            });
+        }
+        /**
+         * Allow callback referer to access this url no matter what
+         * @param context - the execution context
+         * @returns true if the condition is met
+         */
+        async checkRequest(context) {
+            // Only authorize url from this service
+            if (!context.getHttpContext().getRelativeUri().startsWith(this.parameters.url)) {
+                return false;
             }
-        });
-        this.addRoute(this.parameters.url +
-            "/callback{?" +
-            this.getCallbackQueryParams()
-                .map(param => param.name + (param.required ? "" : "?"))
-                .join(",") +
-            "}", ["GET"], this._callback, {
-            get: {
-                description: `Get result from ${name} Authentication`,
-                summary: `Use the token provide to validate with ${name} the user`,
-                operationId: `callbackFrom${name}`,
-                responses: {
-                    "204": {
-                        description: ""
-                    },
-                    "400": {
-                        description: "Missing token"
-                    }
+            const regexps = this.getCallbackReferer();
+            let valid = false;
+            const referer = context.getHttpContext().getUniqueHeader("referer", "");
+            if (this.parameters.no_referer && referer === "") {
+                return true;
+            }
+            for (const i in regexps) {
+                valid = referer.match(regexps[i]) !== null;
+                if (valid) {
+                    break;
                 }
             }
-        });
-        if (this.hasToken()) {
-            this.addRoute(this.parameters.url + "/token", ["POST"], this._token, {
-                post: {
-                    description: `Log with a ${name} token`,
-                    summary: `Use the token provide to validate with ${name} the user`,
-                    operationId: `verify${name}Token`,
-                    responses: {
-                        "204": {
-                            description: ""
-                        },
-                        "400": {
-                            description: "Missing token"
-                        }
-                    }
+            return valid;
+        }
+        /**
+         * Resolve dynamic dependancy
+         * @returns this for chaining
+         */
+        resolve() {
+            super.resolve();
+            this.parameters.with(params => {
+                if (params.url === undefined) {
+                    params.url = this.getDefaultUrl();
                 }
+                if (params.authorized_uris === undefined) {
+                    this.log("WARN", "Not defining authorized_uris is a security risk");
+                }
+                else {
+                    this.authorized_uris = new RegExpStringValidator(params.authorized_uris);
+                }
+                this._authenticationService = useService(this.parameters.authenticationService);
             });
+            return this;
         }
-        if (this.parameters.exposeScope) {
-            this.addRoute(this.parameters.url + "/scope", ["GET"], this._scope, {
+        /**
+         * Get OAuth callback query parameters
+         * @returns the result
+         */
+        getCallbackQueryParams() {
+            return [
+                {
+                    name: "code",
+                    required: true
+                },
+                {
+                    name: "scope",
+                    required: true
+                },
+                {
+                    name: "state",
+                    required: true
+                }
+            ];
+        }
+        /**
+         * Register callback + optional token/scope routes.
+         *
+         * `_redirect` is declared via `@Route` below. The callback query string
+         * depends on {@link getCallbackQueryParams} (subclass-overridable), and
+         * the token/scope routes are conditional on {@link hasToken} and
+         * `parameters.exposeScope`, so those three stay programmatic.
+         *
+         * @returns this for chaining
+         */
+        async init() {
+            await super.init();
+            const name = this.getName();
+            this.addRoute(this.parameters.url +
+                "/callback{?" +
+                this.getCallbackQueryParams()
+                    .map(param => param.name + (param.required ? "" : "?"))
+                    .join(",") +
+                "}", ["GET"], this._callback, {
                 get: {
-                    description: `List ${name} auth scope for this apps`,
-                    summary: "Retrieve the scope intended to be used with this auth",
-                    operationId: `get${name}Scope`,
+                    description: `Get result from ${name} Authentication`,
+                    summary: `Use the token provide to validate with ${name} the user`,
+                    operationId: `callbackFrom${name}`,
                     responses: {
                         "204": {
                             description: ""
@@ -173,122 +238,168 @@ export class OAuthService extends Service {
                     }
                 }
             });
+            if (this.hasToken()) {
+                this.addRoute(this.parameters.url + "/token", ["POST"], this._token, {
+                    post: {
+                        description: `Log with a ${name} token`,
+                        summary: `Use the token provide to validate with ${name} the user`,
+                        operationId: `verify${name}Token`,
+                        responses: {
+                            "204": {
+                                description: ""
+                            },
+                            "400": {
+                                description: "Missing token"
+                            }
+                        }
+                    }
+                });
+            }
+            if (this.parameters.exposeScope) {
+                this.addRoute(this.parameters.url + "/scope", ["GET"], this._scope, {
+                    get: {
+                        description: `List ${name} auth scope for this apps`,
+                        summary: "Retrieve the scope intended to be used with this auth",
+                        operationId: `get${name}Scope`,
+                        responses: {
+                            "204": {
+                                description: ""
+                            },
+                            "400": {
+                                description: "Missing token"
+                            }
+                        }
+                    }
+                });
+            }
+            return this;
         }
-    }
-    /**
-     * Expose the scope used by the authentication
-     * @param ctx
-     */
-    _scope(ctx) {
-        ctx.write(this.parameters.scope);
-    }
-    /**
-     * Define if this provider allow authentication by tokens
-     * @returns
-     */
-    hasToken() {
-        return false;
-    }
-    /**
-     * Check if the url is authorized
-     * @param redirect
-     * @param context
-     * @returns
-     */
-    isAuthorizedUri(redirect, context) {
-        return (!this.parameters.authorized_uris || // If no authorized_uris defined, allow all
-            this.authorized_uris?.validate(redirect) || // If redirect is included in authorized_uris
-            (this.parameters.no_referer && !context.getHttpContext().getUniqueHeader("referer"))); // If no_referer is allowed
-    }
-    /**
-     * Redirect to the OAuth provider
-     *
-     * The calling url must be and authorized_uris if defined
-     * @param ctx
-     */
-    _redirect(ctx) {
-        // implement default behavior
-        const redirect_uri = this.parameters.redirect_uri || `${ctx.getHttpContext().getAbsoluteUrl()}/callback`;
-        const redirect = ctx.getParameters().redirect || ctx.getHttpContext().getHeaders().referer;
-        if (!this.isAuthorizedUri(redirect, ctx)) {
-            throw new WebdaError.Unauthorized("Unauthorized redirect parameter");
+        /**
+         * Expose the scope used by the authentication
+         * @param ctx - the operation context
+         */
+        _scope(ctx) {
+            ctx.write(this.parameters.scope);
         }
-        const session = ctx.getSession();
-        session.oauth ?? (session.oauth = {});
-        // Generate 2 random uuid: nonce and state
-        session.oauth.state = this.getWebda().getUuid("base64");
-        // Redirect to the calling uri
-        session.oauth.redirect = redirect;
-        ctx.redirect(this.generateAuthUrl(redirect_uri, session.oauth.state, ctx));
-    }
-    /**
-     * Handle a token return
-     *
-     * This is private to avoid any override
-     * @param context
-     */
-    async _token(context) {
-        const res = await this.handleToken(context);
-        await this.handleReturn(context, res.identId, res.profile);
-        await this.emitSync("OAuth.Callback", {
-            ...res,
-            type: "token",
-            provider: this.getName(),
-            context
-        });
-        this.metrics.login.inc({ method: "token" });
-    }
-    /**
-     * Handle a standard url callback
-     *
-     * This is private to avoid any override
-     * @param ctx
-     */
-    async _callback(ctx) {
-        const res = await this.handleCallback(ctx);
-        await this.handleReturn(ctx, res.identId, res.profile);
-        await this.emitSync("OAuth.Callback", {
-            ...res,
-            type: "callback",
-            provider: this.getName(),
-            context: ctx
-        });
-        this.metrics.login.inc({ method: "callback" });
-    }
-    /**
-     * Once approved by the OAuth provider this will do the common task
-     * @param ctx
-     * @param identId
-     * @param profile
-     */
-    async handleReturn(ctx, identId, profile, _tokens = undefined) {
-        // If no identId has been provided error
-        if (!identId) {
-            throw new WebdaError.Forbidden("No identId provided by the OAuth provider");
+        /**
+         * Define if this provider allow authentication by tokens
+         * @returns true if the condition is met
+         */
+        hasToken() {
+            return false;
         }
-        const session = ctx.getSession();
-        session.oauth ?? (session.oauth = {});
-        // If authentication service then create a User/Ident couple
-        if (this._authenticationService) {
-            // Should call the onIdentLogin()
-            await this._authenticationService.onIdentLogin(ctx, this.getName().toLowerCase(), identId, profile);
+        /**
+         * Check if the url is authorized
+         * @param redirect - the redirect URL
+         * @param context - the execution context
+         * @returns true if the condition is met
+         */
+        isAuthorizedUri(redirect, context) {
+            return (!this.parameters.authorized_uris || // If no authorized_uris defined, allow all
+                this.authorized_uris?.validate(redirect) || // If redirect is included in authorized_uris
+                (this.parameters.no_referer && !context.getHttpContext().getUniqueHeader("referer"))); // If no_referer is allowed
         }
-        else {
-            // Login in session
-            ctx.getSession().login(identId, identId);
-            // Store the profile retrieved
-            session.oauth.profile = profile;
+        /**
+         * Inject the provider name into openapi template replacements so the
+         * `${name}` placeholders in `@Route` metadata resolve per-instance.
+         *
+         * @returns replacements map merged with defaults
+         */
+        getOpenApiReplacements() {
+            return { ...super.getOpenApiReplacements(), name: this.getName() };
         }
-        // Redirect to our targets
-        if (session.oauth.redirect) {
-            ctx.redirect(session.oauth.redirect);
+        /**
+         * Redirect to the OAuth provider
+         *
+         * The calling url must be and authorized_uris if defined
+         * @param ctx - the operation context
+         */
+        _redirect(ctx) {
+            // implement default behavior
+            const redirect_uri = this.parameters.redirect_uri || `${ctx.getHttpContext().getAbsoluteUrl()}/callback`;
+            const redirect = ctx.getParameters().redirect || ctx.getHttpContext().getHeaders().referer;
+            if (!this.isAuthorizedUri(redirect, ctx)) {
+                throw new WebdaError.Unauthorized("Unauthorized redirect parameter");
+            }
+            const session = ctx.getSession();
+            session.oauth ??= {};
+            // Generate 2 random uuid: nonce and state
+            session.oauth.state = getUuid("base64");
+            // Redirect to the calling uri
+            session.oauth.redirect = redirect;
+            ctx.redirect(this.generateAuthUrl(redirect_uri, session.oauth.state, ctx));
         }
-        else {
-            ctx.write("Your authentication is successful");
+        /**
+         * Handle a token return
+         *
+         * This is private to avoid any override
+         * @param context - the execution context
+         */
+        async _token(context) {
+            const res = await this.handleToken(context);
+            await this.handleReturn(context, res.identId, res.profile);
+            await this.emit("OAuth.Callback", {
+                ...res,
+                type: "token",
+                provider: this.getName(),
+                context
+            });
+            this.metrics.login.inc({ method: "token" });
         }
-        // Clean variables from session
-        session.oauth.state = undefined;
-        session.oauth.redirect = undefined;
-    }
-}
+        /**
+         * Handle a standard url callback
+         *
+         * This is private to avoid any override
+         * @param ctx - the operation context
+         */
+        async _callback(ctx) {
+            const res = await this.handleCallback(ctx);
+            await this.handleReturn(ctx, res.identId, res.profile);
+            await this.emit("OAuth.Callback", {
+                ...res,
+                type: "callback",
+                provider: this.getName(),
+                context: ctx
+            });
+            this.metrics.login.inc({ method: "callback" });
+        }
+        /**
+         * Once approved by the OAuth provider this will do the common task
+         * @param ctx - the operation context
+         * @param identId - the identity identifier
+         * @param profile - the user profile
+         * @param _tokens - the authentication tokens
+         */
+        async handleReturn(ctx, identId, profile, _tokens = undefined) {
+            // If no identId has been provided error
+            if (!identId) {
+                throw new WebdaError.Forbidden("No identId provided by the OAuth provider");
+            }
+            const session = ctx.getSession();
+            session.oauth ??= {};
+            // If authentication service then create a User/Ident couple
+            if (this._authenticationService) {
+                // Should call the onIdentLogin()
+                await this._authenticationService.onIdentLogin(ctx, this.getName().toLowerCase(), identId, profile);
+            }
+            else {
+                // Login in session
+                ctx.getSession().login(identId, identId);
+                // Store the profile retrieved
+                session.oauth.profile = profile;
+            }
+            // Redirect to our targets
+            if (session.oauth.redirect) {
+                ctx.redirect(session.oauth.redirect);
+            }
+            else {
+                ctx.write("Your authentication is successful");
+            }
+            // Clean variables from session
+            session.oauth.state = undefined;
+            session.oauth.redirect = undefined;
+        }
+    };
+})();
+export { OAuthService };
 //# sourceMappingURL=oauth.js.map